Re: [rtcweb] A plea for simplicity, marketability - and... who are we designing RTCWEB for?

[Iñaki Baz Castillo <[e-mail]>]

2011/10/20 Roman Shpount <[e-mail]>:
> This application will never setup a P2P call between two browsers, it is
> always between provider and the browser, so it can ask for relaxed security
> since it only calls its own IP.

There is long rationale about this topic in the list. Security cannot
(MUST NOT) be relaxed, never, because just the human can determine
when to allow "relaxed security" (and we don't want that a malicius
site asks the human user "press Accept Relaxed Security and you can
win a car". The browser has no way to determine whether the
destination of *all* the calls is a "trusted" server or not.

Also you are asuming that the media is sent to the same IP of the web
server (in case a RTCweb scenario does not include user2user calls).
This is a too much simplified scenario, and you miss that a DNS A
record can point to N IP's, and you also miss the case in which the
webserver has an IP different than the media server (regardless they
both are located within the same provider infrastucture). The browser
cannot determine it by itself, so security is always a need, and IMHO
it's a bad idea to allow a very corner case in which such security
could be relaxed.

-- 
Iñaki Baz Castillo
<[e-mail]>